1. COMPLYING WITH SARBANES- OXLEY SECTION 404: MANAGEMENT’S ASSESSMENT OF THE ACTUARIAL CONTROL ENVIRONMENT Brian Reilly, Senior Vice President & Chief Auditor St. Paul Travelers September 12, 2006

2. 1 Management’s Assessment of the Actuarial Control Environment OVERVIEW  Sarbanes-Oxley Act Overview  Internal controls over financial reporting  Implications to the Actuarial Community  Significant judgment involved in setting reserves  Management’s best estimates  Focal point for external auditors

3. 2 Management’s Assessment of the Actuarial Control Environment OVERVIEW  SOX 404 Requirements  Management’s assessment of controls  Documentation of process  Assess control design  Assess effectiveness of controls  Evidence of control effectiveness is critical  External Auditor’s Report  Evaluation of management’s assessment  Independent assessment of internal controls over financial reporting

4. 3 Management’s Assessment of the Actuarial Control Environment WHY CONSIDERED A KEY RISK AREA?  Reserves can be inadequate or unreasonable.  Inaccurate analysis of reserves,  Inappropriate interpretation of data,  Faulty assumptions, judgments or methodologies.  Key dependency on integrity of data.  Heavy reliance on spreadsheets/data models (EUC tools).  Reserve selection process may be flawed.  Perceived management of earnings.

5. 4 OBJECTIVE: EVALUATION OF RISKS AND CONTROLS  Management must identify all the financial statement risks and assess the key controls that mitigate the risks.  If no controls exist, or existing controls are weak, management must develop compensating controls.  If not addressed, likely at least a significant deficiency. Management’s Assessment of the Actuarial Control Environment

6. 5 Management’s Assessment of the Actuarial Control Environment Assess the materiality of reserves to the entity Develop an understanding of the risks Assess the controls that mitigate the risks To evaluate the risks and controls:

7. 6 Management’s Assessment of the Actuarial Control Environment Assess the materiality of reserves to the entity  Assume loss reserves are material to financial statements  Also need to consider: segment vs. consolidated reserves

8. 7 Management’s Assessment of the Actuarial Control Environment Develop an understanding of the risks  Risks & controls differ depending on the organizational structure (centralized vs. decentralized).  Data integrity: complete, accurate and timely.  Development and documentation of loss triangles.  Analysis and selection of actuarial indications.  Booking of management’s best estimate to the financials.

9. 8 Management’s Assessment of the Actuarial Control Environment  Data Gathering & Data Integrity.  System Controls.  Balancing Controls.  Controls over modeling & development of actuarial indications.  Reconciliation controls.  Documentation of management’s best estimate determination.  Evaluation of results – ~Change in position and ending position ~Segments and consolidated Assess the controls that mitigate the risks

10. 9 Management’s Assessment of the Actuarial Control Environment DData Gathering & Data Integrity Sufficient data extraction procedures and documentation to prove integrity, completeness and accuracy.

11. 10 Assess the controls that mitigate the risks Management’s Assessment of the Actuarial Control Environment  System Controls Access/security controls Servers Models Cells Backup and recovery End user computing

12. 11 Assess the controls that mitigate the risks Management’s Assessment of the Actuarial Control Environment CControls over modeling & development of actuarial indications Peer review (QA) Independent reviews Quarterly certification process

13. 12 Assess the controls that mitigate the risks Management’s Assessment of the Actuarial Control Environment DDocumentation of management’s best estimate determination (segment & consolidated basis) Business Group management reviews. Review and approval by Chief Actuary and CFO/CEO. Audit Committee executive session with Chief Actuary.

14. 13 Why is it important to have a sound control environment?  Management must be able to rely on the results of the actuarial analysis.  SEC: Sarbanes-Oxley implications.  IRS: Tax implications/challenges.  Rating Agencies: Company rating concerns.  State Regulators: Solvency and oversight responsibilities.  External Auditors: Attesting to the accuracy of the organization’s financial results. Management’s Assessment of the Actuarial Control Environment

15. 14 Management’s Assessment of the Actuarial Control Environment Questions?